Public roadmap

What shipped recently, what is in beta, and what is planned next. This page is written for customers who want to understand where the product is going before they choose a plan.

Last updated: 2026-06-02

Shipped Available today

Everything below is available for customers today through the online product, desktop app, account dashboard, or optional technical integrations.

Maximum mode for stronger protection

Maximum mode makes public JavaScript much harder to read, search, copy, and analyze automatically. Each protected release changes shape so repeat attacks have less reusable structure.

2024-Q4 · All paid tiers

Runtime defense options

Additional controls help make tampering, debugging, and unauthorized use harder for valuable public JavaScript.

2026-Q1 · Corporate+

Advanced package for technical teams

Technical teams can connect JavaScript Obfuscator to existing release tools when protection needs to run the same way every time.

2026-Q1 · npm guide ›

Compatibility analyzer

Checks for names and patterns that may need to stay unchanged, helping customers avoid compatibility problems before protected code ships.

2026-Q1 · Docs ›

VS Code extension

Protect a file or selected code from VS Code without switching windows.

2026-Q2 · Marketplace listing

GitHub Action

For teams that already use GitHub to manage releases and want JavaScript protection to run as part of that process.

2026-Q2 · Marketplace listing

Readable errors after protection

Support tools help technical teams translate protected error reports during troubleshooting while keeping sensitive mapping data under customer control. Docs › · Interactive demo ›

2026-Q2 · npm package

JetBrains IDE plugin

Protect a file or selected code from JetBrains editors used by many web and application teams.

2026-Q2 · Plugin marketplace

Team automation templates

Template starting points help organizations connect protection to common release systems when every public release needs the same treatment.

2026-Q2 · npm package ci/ folder

Other technical environments

Teams using Python, Go, .NET, Ruby, PHP, Rust, Java, or custom release systems can still connect protection without changing their whole stack. Reference doc ›

2026-Q2 · PyPI / Maven / NuGet / RubyGems / Packagist / crates.io

Pre-release checks

Optional checks help technical teams catch setup mistakes before protected JavaScript moves toward release.

2026-Q2 · .pre-commit-hooks.yaml

Error-reporting support

Supported error-reporting paths help teams investigate protected-code issues without exposing original source.

2026-Q2 · jso-symbolicate subpath exports

Migration guides for Jscrambler and the OSS package

Guides help customers compare product fit and move from Jscrambler or a free obfuscator without guessing which features matter.

2026-Q2 · Jscrambler · OSS

Ways-to-use hub and troubleshooting demo

Ways to use JavaScript Obfuscator explains online, desktop, editor, and advanced team options. The troubleshooting demo runs locally in the browser.

2026-Q2 · Public site

Release review identifiers

Advanced workflows include release identifiers that help technical reviewers match protected output to the report created during protection.

2026-Q2 · All paid tiers

Watermark and release proof options

Advanced release options help teams prove which protected output came from which release, estimate usage before protection, and review protected files later. Spec › · Recipes ›

2026-Q2 · jso-protector 0.5+ · GitHub Action v0.2

AI-assisted compatibility checks

Preview tools help customers spot JavaScript patterns that may need review before protection. Quick start ›

2026-Q2 · jso-protector 0.4+ · All AI tiers

Security event forwarding to Splunk, Elasticsearch, and webhooks

Tamper events detected at runtime can now be routed to the same monitoring tools your security team already uses, so on-call rotations see them without polling.

2026-Q2 · jso-beacon-slack 0.1+ · Corporate+

Payment-page compliance evidence (PCI DSS v4)

Generates a Markdown audit report mapping your protected build to PCI DSS v4 controls 6.4.3 and 11.6.1. Useful when QSAs ask for evidence that scripts are authorized, integrity-checked, and tamper-monitored.

2026-Q2 · jso-protector 0.3+ · Free for all paid tiers

Magecart detection: spot unauthorized scripts on payment pages

A runtime module catalogs every script the browser actually loads and flags anything outside your allowlist, anything injected after page load, or any cached script whose contents changed since the last deploy.

2026-Q2 · jso-protector/runtime/third-party-inventory · All tiers

Active responses to tampering

When runtime defense detects tampering, you can now configure how the page reacts: log only, break the protected entry, clear cookies, redirect to a safe URL, or invoke a custom callback. Pair with the beacon for a complete detect-and-respond loop.

2026-Q2 · jso-protector/runtime/countermeasures · Corporate+

Different protection profiles per app section

A single build can apply maximum protection to your checkout flow, standard protection to marketing pages, and so on. Files are matched by globs, and protection settings cascade so you only override what differs.

2026-Q2 · jso-protector namedSets config · All paid tiers

Electron bytecode protection

For Electron desktop apps, a post-protection step compiles your JavaScript to V8 bytecode. The result is bound to the Electron release you ship against and much harder to reverse than minified source.

2026-Q2 · jso-protector-electron 0.1+ · Corporate+

Mobile app tamper detection (React Native, Cordova, Ionic)

A runtime guard for hybrid mobile apps detects rooted/jailbroken devices, emulators, and runtime hooking tools (Frida, Magisk, unc0ver, checkra1n), then routes the verdict to your monitoring tools and runs a response you control. Pairs the JavaScript bundle obfuscation you already get with mobile-class device checks.

2026-Q2 · jso-protector-reactnative 0.1+ · Corporate+

Beta Early access for Corporate and Enterprise

Beta features are available to selected accounts while we validate compatibility, support needs, and performance tradeoffs.

Advanced protection for selected sensitive functions

For small pieces of high-value JavaScript where extra runtime cost is worth the added protection, such as licensing checks, anti-tamper logic, or proprietary algorithms. Docs ›

2026-Q2 beta · Corporate+

Stronger release integrity checks

Additional checks help teams prove that protected JavaScript has not been changed after release preparation. This is useful for customers with stricter audit or distribution requirements.

2026-Q2 beta · Corporate+

Next Planned customer-facing improvements

These items are in active planning or development. Dates can move as compatibility, quality, and customer feedback reshape priorities.

JSO AI Phase 1 — setup help

Optional AI guidance to help customers choose protection settings, check compatibility risks, and understand errors without reading every technical option first. See AI pricing.

2026-Q3 · AI add-on, all obfuscation tiers

JSO AI Phase 2 — protection recommendations

Planned guidance that helps customers decide which files or functions deserve stronger protection and which can stay on a lighter setting for speed or compatibility.

2026-Q4 · AI Corporate+

JSO AI Phase 3 — stronger evidence for Enterprise

Planned reports that help Enterprise customers show how their protected JavaScript holds up against current automated analysis tools.

2027-Q1 · AI Enterprise

Threat-monitoring dashboard

A dashboard for runtime defense events so teams can see suspicious activity without building their own first view.

2026-Q3 · Corporate+

Better production error troubleshooting

Improved mapping details will make protected-code errors easier to translate in common monitoring tools.

2026-Q3 · All paid tiers

Broader compatibility for advanced protection

Expanding which JavaScript patterns can use the highest-cost advanced protection safely.

2026-Q3 design · VM beta participants

Interactive protection examples

Let visitors paste small snippets and see how different protection choices change the output.

2026-Q3 · Public site

Threat-monitoring dashboard polish

Better filtering, saved views, alert rules, and clearer activity summaries for teams using runtime defense.

2026-Q4 · Corporate+

Research Investigating, no delivery date yet

These ideas are under investigation. Customer feedback affects priority, but these are not committed launch promises.

Harder-to-classify protection shapes

Research into protected output that is harder for automated analysis tools to separate into predictable setup code and original business logic. Threat-model write-up ›

Protection tied more tightly to the real runtime

Research into options that make protected code harder to study outside the real browser, account, or session where it is expected to run.

Offline-analysis detection

Research into detecting when protected code is being studied in an artificial environment instead of a normal customer browser.

More Electron protection options

Investigating better protection for Electron applications where JavaScript exists outside the browser window.

Optional hosted troubleshooting maps

Investigating whether some customers want hosted map storage for easier troubleshooting, balanced against the privacy benefits of keeping those maps fully customer-controlled.

Smaller advanced-protection runtime

Researching ways to reduce runtime size and make the heaviest protection layer harder to inspect.

Lower-cost starter plan

Investigating whether a smaller paid plan would help customers who need more than Free but are not ready for the current Basic tier.

Things we deliberately won't do

These choices protect customer control, privacy, and long-term portability.

Send protected output back through a third-party CDN

Some competitors host the obfuscated output behind a per-customer subdomain. We don't — you keep the output, and we do not keep either the input or output after the protection request is complete.

Single-vendor lock-in via proprietary runtime

Protected JS runs in a vanilla browser or Node runtime. No required SDK, no required CDN script, no required server-side proxy. If you leave JSO, your shipped builds keep running.

Send your code to an outside AI provider for analysis

The Compatibility Analyzer and related review paths are deterministic. We don't ship your source to an outside AI provider for "AI-powered" suggestions.

Got a feature ask not on this page? Tell us ›